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We introduce a new continuous-variable quantum key distribution (CV-QKD) protocol, self-referenced CV- 
QKD, that eliminates the need for transmission of a high-power local oscillator between the communicating 
parties. In this protocol, each signal pulse is accompanied by a reference pulse (or a pair of twin reference 
pulses), used to align Alice’s and Bob’s measurement bases. The method of phase estimation and compensation 
based on the reference pulse measurement can be viewed as a quantum analog of intradyne detection used in 
classical coherent communication, which extracts the phase information from the modulated signal. We present 
a proof-of-principle, fiber-based experimental demonstration of the protocol and quantify the expected secret 
key rates by expressing them in terms of experimental parameters. Our analysis of the secret key rate fully takes 
into account the inherent uncertainty associated with the quantum nature of the reference pulse(s) and quantifies 
the limit at which the theoretical key rate approaches that of the respective conventional protocol that requires 
local oscillator transmission. The self-referenced protocol greatly simplifies the hardware required for CV- 
QKD, especially for potential integrated photonics implementations of transmitters and receivers, with minimum 
sacrifice of performance. As such, it provides a pathway towards scalable integrated CV-QKD transceivers, a 
vital step towards large-scale QKD networks. 


I. INTRODUCTION 

Quantum key distribution (QKD), which enables the gen¬ 
eration of secure shared randomness between two distant par¬ 
ties (Alice and Bob) [1], is the most advanced quantum tech¬ 
nology to date [2-4]. Discrete-variable QKD (DV-QKD) is 
the term for well-established protocols that involve genera¬ 
tion and detection of extremely weak pulses of light (ideally, 
single photons). Unfortunately, significant technological chal¬ 
lenges still remain in generation and detection of single pho¬ 
tons, although important advances have been made over past 
three decades [4, 5]. Protocols for an alternative approach, 
continuous-variable QKD (CV-QKD), were developed more 
recently [2, 6]. CV-QKD utilizes conjugate continuous de¬ 
grees of freedom (field quadratures) of a light pulse prepared 
in a Gaussian (coherent or squeezed) state to transmit the sig¬ 
nals that constitute the shared randomness. At the receiver, the 
quadratures are measured using shot-noise limited balanced 
homodyne or heterodyne detectors, which have the advantage 
of not requiring single photon detection and operating at ex¬ 
tremely high detection rates (on the order of GHz). In particu¬ 
lar, the coherent-state CV-QKD protocol has received much 
attention because of its promise of achieving information- 
theoretically secure key distribution with modest technolog¬ 
ical resources [7-9]. The technical ease of CV-QKD is bal¬ 
anced by more complex and less efficient post-processing 
schemes for distilling a shared secret key from the imper¬ 
fect shared randomness established during the quantum signal 
exchange portion of the protocol. However, with the recent 
development of higher efficiency error correction codes [10- 
12] and more comprehensive security proofs [13-15] for CV- 
QKD, it is becoming an attractive alternative to DV-QKD. A 
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particular reason for the appeal is the expectation that the in¬ 
tegrated photonics implementation of CV-QKD will be easier 
than that of DV-QKD, and such implementations are critical 
for the next phase of QKD development that is focused on 
practicality and wide-spread utilization. 

A major obstacle to the implementation of CV-QKD, espe¬ 
cially in integrated photonics, is the requirement for transmis¬ 
sion of a local oscillator (LO) between Alice and Bob. Current 
fiber-based implementations co-transmit the LO with the sig¬ 
nal states using techniques that involve combinations of time- 
division multiplexing (TDM), wavelength-division multiplex¬ 
ing (WDM), and polarization encoding [10, 16]. Free-space 
implementations of CV-QKD also multiplex using the polar¬ 
ization degree of freedom [17]. Since the LO intensity dic¬ 
tates the quality of quadrature measurement at Bob’s receiver, 
it is desirable to transmit a high-power LO that is many orders 
of magnitude more intense than the signal pulse. Due to this 
power disparity, multiplexing has to significantly separate the 
two components in order to minimize the contamination of the 
signal states by photons scattered from the LO (for example, 
this is the reason for combining polarization encoding with 
TDM, as in Ref. [10]). This degree of separation in multiplex¬ 
ing (and associated demultiplexing at Bob’s receiver) greatly 
complicates the hardware required for CV-QKD, and is even 
a roadblock for integrated photonics implementations of CV- 
QKD since TDM and polarization manipulation and mainte¬ 
nance are more difficult on-chip [18-20]. Another compli¬ 
cation associated with the requirement of LO transmission is 
that a relative phase shift arises between the signal and LO due 
to the path separation during demultiplexing at the receiver 
[16, 21]. This shift can be compensated by precise calibration 
of the separated paths, which is however not a robust solu¬ 
tion, or by dynamic phase estimation at the receiver, in which 
case the speed at which this estimation can be done becomes 
a practical limitation on the rate of key generation. 
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FIG. 1. Hardware schematic for the SR-CV-QKD protocol. In con¬ 
trast to conventional CV-QKD implementations (e.g., Ref. [10]), the 
hardware requirements are dramatically simplified due to elimination 
of LO transmission. 


In this work, we eliminate all of the issues outlined above 
by developing a coherent-state CV-QKD protocol that elimi¬ 
nates the transmission of an LO between Alice and Bob. We 
achieve this by noticing that a common reference frame be¬ 
tween Alice and Bob can be established by a method that, 
instead of transmitting the LO, uses regularly spaced refer¬ 
ence pulses whose quadratures are measured by Bob to esti¬ 
mate Alice’s phase reference. This new protocol, which we 
call self-referenced CV-QKD (SR-CV-QKD), greatly simpli¬ 
fies the hardware requirements at Alice’s and Bob’s stations 
since it enables them both to employ independent (truly local) 
LOs. In addition, SR-CV-QKD obviates a key assumption of 
most CV-QKD security proofs [14] — namely that the LO is 
trusted — and thus provides a more secure implementation of 
CV-QKD. We demonstrate the key elements of SR-CV-QKD 
using a fiber-based setup utilizing fiber-pigtailed bulk-optics 
components. However, we stress that this protocol is mani¬ 
festly compatible with chip-scale implementation since it only 
requires (low-loss and low-noise) classical optical communi¬ 
cation components, as outlined in Fig. 1. 

The remainder of the paper is organized as follows. The 
SR-CV-QKD protocol is described in Sec. II. In Sec. Ill we 
use the entanglement-based theoretical description of SR-CV- 
QKD to analyze the secret key rate under individual and col¬ 
lective Gaussian attacks. Section IV presents the details of 
the experimental demonstration of the protocol’s feasibility. 
Finally, our conclusions are summarized in Sec. V. 


II. DETAILS OF THE SR-CV-QKD PROTOCOL 



FIG. 2. The phase-space representation of Alice’s and Bob’s mis¬ 
aligned reference frames. The reference pulse is assumed to be on 
the Qa axis for Alice in this example, and the signal pulse is ran¬ 
domly placed. 


as A/*(0, Va), and sends Bob the coherent state \qa + ip a), 
which we refer to as the signal pulse. In addition, she sends a 
coherent-state reference pulse in the next time bin. The mean 
quadrature values of the reference pulse in Alice’s reference 
frame, (qA R , Pa r X 1 are publicly known. The amplitude of 
the reference pulse, 2 V^ 2 = ( q\ R + p\ R ) X ^ 2 ^ is fixed and 

may be several times larger than V A , but much smaller than 
that of a typical LO. Using reference pulses with a relatively 
small amplitude is a practically important aspect of SR-CV- 
QKD, which helps to reduce the interference with the signal 
pulse, as compared to the effect of a large-amplitude (classi¬ 
cal) pulse, whose “long tail” cannot be completely suppressed 
and hence would interfere with the signal if time multiplexed 
at the same rate. 

In each round, Bob performs a homodyne measurement of 
one of the quadratures ( Qb or Pb) of the received signal pulse 
to estimate its mean value (qs or pb, respectively), where 
these quadratures are defined relative to his own high-power 
LO. He also performs a heterodyne measurement on the re¬ 
ceived reference pulse to obtain both of its mean quadrature 
values, qs R and ps R (again, with respect to his LO). 

The phase-space representation of Alice’s and Bob’s mis¬ 
aligned reference frames is shown in Fig. 2. The phase differ¬ 
ence 0 between Alice’s and Bob’s frames is a time-dependent 
quantity since their individual LOs are free-running, and we 
assume that 6 at any time is a random variable distributed uni¬ 
formly on (— 7r, 7r] and that the frequency of its fluctuations 


In this section, we describe the prepare-and-measure ver¬ 
sion of the protocol, which corresponds to the actual physical 
implementation. The equivalent entanglement-based descrip¬ 
tion is presented in Sec. III. 

In each round of SR-CV-QKD, Alice chooses two inde¬ 
pendent Gaussian random variables (g^ 5 Pa), both distributed 


1 We use lowercase letters q and p for c-number mean values of quadratures 
and capital letters Q and P for quadrature operators. 

2 Throughout this paper, we express all quadrature variances and correlations 
in shot-noise units, No, and all quadrature values and amplitudes in units 

Of Ary 2 . 
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(i.e., the phase noise bandwidth), fo, which is measured and 
calibrated before the protocol begins, is much lower than the 
rate of pulse generation. In other words, let At be the time 
delay between signal and reference plus the duration of both 
pulses. Then, we require that this duration is much shorter 
than the inverse of the bandwidth fo, i.e., 

At « fo 1 - ( 1 ) 

Provided that condition (1) is satisfied, the 0 value will be the 
same for measurements on both pulses. We note that Eq. (1) 
also places a restriction on the phase stability of Alice’s laser 
source; specifically, this source should be phase stable over 
the time period specified by At. The same phase stability is 
required of Bob’s LO. 

Estimation of the phase difference 6 is the key element in 
SR-CV-QKD. Since Bob knows the mean quadrature values 
of the reference pulse both in Alice’s frame, ( qa r , Pa r ), and 
in his own frame, (fe H , Pb r X he can calculate an estimate 9 
of the phase difference, via: 


Qb r \ _ ( cos 0 — sin §\ 

Pb r ) ef \sin# cos# ) 



( 2 ) 


where 0 < T e ^ < 1 is the effective channel transmittance that 
can be eliminated to obtain 


0 = tan- 1 ( PBr</Ar gBRPx " ) . (3) 

\Qb r Qa r H" Pb r Pa r ) 

In the following we will assume without loss of generality that 
Alice’s reference pulse has pa r = 0, in which case Eq. (3) 
becomes 


0 = tan -i(W). (4) 

\Qb r J 

Since the reference pulse has a relatively small amplitude, its 
quantum uncertainty cannot be ignored, and therefore even in 
the case of a technically ideal measurement, there will be an 
error in the phase difference estimate, i.e., 

0 = 0 + y>, (5) 

where the estimation error (p is a random variable distributed 
according to some probability distribution V(p). We assume 
that 0 and <p are independent random variables, since they 
arise from separate physical processes. We will see in Sec. Ill 
that the error of phase difference estimation plays a critical 
role in determining the expected secret key rate of SR-CV- 
QKD. 

As is standard in modern CV-QKD, our protocol employs 
reverse reconciliation. Bob sends Alice his estimate of the 
phase difference between their frames, 6 , and which quadra¬ 
ture of the signal pulse ( Qb or Pb) he measured. Then Alice 
rotates her tabulated values for the signal pulse by 6, to obtain 
an estimate (g# or ps) of Bob’s measured quadrature value, 
via 


f Qb 
\Pb 


V^eff 


f cos 6 
\sin6 


— sin 0\ 
cos 0 J 



( 6 ) 


At this point Alice and Bob share a partially correlated Gaus¬ 
sian random variable and the remainder of the protocol is the 
same as conventional CV-QKD, which proceeds by perform¬ 
ing channel estimation, error correction, and privacy amplifi¬ 
cation after a large enough block of (imperfect) shared ran¬ 
domness has been collected [9, 10]. 

We mention a number of points about the new protocol be¬ 
fore examining it quantitatively. First, the occurrence ratio 
of reference pulses to signal pulses does not have to be 1:1. 
If the phase drift is significantly slower than the signal pulse 
rate, then one can utilize fewer reference pulses to estimate the 
slow drifting phase difference. In this situation, condition (1) 
should hold for At being the period between subsequent ref¬ 
erence pulses. 

Second, the frequency difference between Alice’s source 
and Bob’s LO should be reasonably stable: this can be ac¬ 
complished through the use of single-frequency lasers locked 
individually to a stable reference frequency such as an atomic 
line. In case the stable frequency reference is difficult to im¬ 
plement, commercially available single-frequency lasers can 
still be utilized. If the relative frequency drift is slow and 
the linewidth is sufficiently narrow, the drift can be treated 
as a phase noise, which the SR-CV-QKD scheme will han¬ 
dle. However, if the relative frequency drift is fast, one should 
consider frequency locking Bob’s LO by utilizing a dedi¬ 
cated locking beam and utilizing the transfer cavity technique 
[22, 23]. We note that synchronizing separate laser sources 
may turn out to be a particularly challenging task in circum¬ 
stances where practical limitations on laser properties exist 
(e.g., limited coherence properties of available on-chip lasers 
for integrated photonics implementations). 

Third, utilizing a heterodyne detector and a homodyne de¬ 
tector in concert (heterodyne for reference pulses and homo¬ 
dyne for signal pulses) can be challenging since consecutive 
pulses need to be routed to the correct detector. This can be 
accomplished by either actually having two types of detectors 
and routing each pulse accordingly, or, more practically, by 
frequency detuning the local oscillator from the carrier fre¬ 
quency when a heterodyne detection is required. Such small 
detuning can be performed at GHz rates and thus this solu¬ 
tion is valid if the pulses are nanosecond separated. How¬ 
ever, in some instances Bob may be restricted to performing 
homodyne measurements only, for example, if it is desirable 
to simplify his receiver hardware as much as possible. In 
this case Alice can send a pair of closely spaced twin ref¬ 
erence pulses, and Bob will perform orthogonal quadrature 
measurements on them sequentially, obtaining qb r from the 
measurement on one reference pulse and ps R from the mea¬ 
surement on the other. In addition to hardware simplification, 
this twin-reference-pulse mode results in a lower uncertainty 
of the phase difference estimate, as quantified in Sec. Ill be¬ 
low, but at the expense of a reduction in the number of time 
bins available for signal pulses (which constitute the raw data 
for the eventual key) for a fixed communication time. 

Finally, we note that using reference pulses to perform 
phase drift estimation is not only useful for the SR-CV-QKD 
protocol per se , but also for calibration purposes before and 
during the protocol. This technical improvement is discussed 
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in more detail in Appendix B. 


III. SECRET KEY RATE ANALYSIS 

While claims of secure key distribution should be based 
on empirically estimated correlations between Alice and Bob 
[15], it is common to calculate an expected secret key rate 
based on reasonable assumptions on the communication chan¬ 
nel and detection apparatus. The usefulness of such a theoret¬ 
ical analysis is in revealing the effects of various design pa¬ 
rameters on the achievable key rate. This calculation is partic¬ 
ularly important in our case since it allows us to compare the 
expected performance of SR-CV-QKD against the respective 
conventional protocol that requires LO transmission. 

We follow the approach in Refs. [2, 24] and compute the 
asymptotic expected key rate in the presence of a lossy, noisy 
passive Gaussian process, £, that models channel transmit¬ 
tance, channel excess noise, detection inefficiency, and elec¬ 
tronic detector noise. The entanglement-based description 
of the conventional protocol begins with the density matrix 
for the state shared between Alice and Bob before they per¬ 
form any measurements: pab = £{psv )> where psv is 
the ideal two-mode squeezed vacuum state. Since psv and 
£ are Gaussian, one can equivalently express the state pab 
in terms of its covariance matrix (represented in the basis 
{Qa,Pa,Qb,Pb}) [2,24]: 

_ / VI Ca z \ ... 

1AB - \Ca z T V (V + x)l) (?) 

with 

c = ^#M), (8) 


In SR-CV-QKD, in addition to the process £, we need to 
take into account the effect of phase-space rotations due to 
the reference frame mismatch, including averaging over dis¬ 
tributions of random variables 6 and (p. The resulting density 
matrix for the state shared between Alice and Bob before they 
perform any measurements is 

/ 7T r 7T JiO 

d<pV(<fi) J ^Pab(0,0) ( 10 ) 

with 

pab 0,0) = u A (-9)u B (e) PAB u\(-e)ul s (e), an 

where Ua(b)(4 >) is the operator of a phase-space rotation of 
Alice’s (Bob’s) mode by angle </>. The interpretation of this 
state is that Bob’s mode undergoes a rotation by the angle 
equal to the actual phase difference 6, and Alice attempts to 
compensate for this by applying a rotation of her mode by the 
angle — 6. Note that in the ideal case where 6 = 6, these ro¬ 
tations describe an orthogonal transformation of Bob’s state 
and the conjugate orthogonal transformation [27] of Alice’s 
state, whose combination leaves the bipartite state invariant, 
i.e., pab (9 , 6) = p AB and, consequently, p AB = Pab in the 
ideal case. Thus, in the entanglement-based description, the 
SR-CV-QKD protocol can be seen as an attempt to restore the 
imperfect EPR correlations in the state Ub(6)pabUb(6) by 
compensating for the random rotation experienced by Bob’s 
mode. 

The state ~p A B i s a l so Gaussian, and its covariance matrix 
can be expressed as 

/ 7T rir JQ 

difiV{A j —~iab{ 0 , 9 ) (12) 


where 11 = Q ^ and a z = ^ . In Eqs. (7) and ( 8 ), T 

is the channel transmittance, p is the detector efficiency (so 
the overall effective transmittance is T e # = Tp), x i s the 
channel noise (referred to the input of the channel), and V 
is the variance of both quadratures of Alice’s output state, i.e., 
V = Va + 1, where Va is the variance of Alice’s Gaussian 
modulation of the signal pulse. The noise can be modeled as 
a sum of three terms [ 2 ] : 


X = 


1 -Tp 
Ti 7 


+ 7fT + 
1 p 


(9) 


where the first term is the loss-induced vacuum noise, the sec¬ 
ond term is the contribution of the detector electronic noise 
with the variance V e \, and £ is the excess noise in the channel. 
Note that this noise model treats channel and detector contri¬ 
butions on equal footing, thus resulting in a conservative esti¬ 
mate of the expected key rate. Some works [9, 21, 25, 26] use 
a more nuanced model which assumes that Eve cannot benefit 
from the noise added by Bob’s detector, therefore resulting in 
a more optimistic key rate estimate. In this work, we use the 
conservative noise model of Ref. [2], which corresponds to a 
stronger security scenario. 


with 


7 ab(9,9)= U a (-0)®U b (0) 


1AB 


U^(- 0 )®UT( 0 ) 


(13) 


where Ua( B ) is the symplectic representation of a phase-space 
rotation operator U A ( B ) [ 6 ]. Computing these rotations and 
integrals yields 


- - ( V l. 

Iab ~ Tri(V + x)t 

with 

cos ip sin (p \ 
sin (p —cos ip J ’ 

cosy = d<pp(<p) cos y, 

sin cp = d<pV((p) sin (p. { 

Comparing the covariance matrix 7 A b °f Eq. (14) to 7 ab of 
Eq. (7), we see that the effect of the reference frame align¬ 
ment in SR-CV-QKD is to replace o z by <f> in off-diagonal 
blocks. In the following we will assume that the phase esti¬ 
mation error is dominated by the quantum uncertainty of the 
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reference pulse(s), in which case the distribution V(<p) is sym¬ 
metric around cp = 0, and consequently sin ip = 0. Then, 

= cos cp a z , (17) 


A. Individual attacks 

The asymptotic secret key rate against individual attacks for 
reverse reconciliation is given by 


and the effect of the reference frame alignment is to sim¬ 
ply rescale the ( QaQb ) and ( PaPb ) correlations by the 
factor cos (p. Therefore we can carry over the analysis in 
Refs. [2, 24] for the respective conventional CV-QKD proto¬ 
col, and simply replace the off-diagonal blocks in the covari¬ 
ance matrix by the scaled versions. 

A more visual way for evaluating variances and correlations 
in SR-CV-QKD is by using the Heisenberg picture, i.e., apply¬ 
ing the phase-space rotations to the quadrature operators, 


/ Qa{ 0)\ = fcos§ - sin0\ / Q a \ 
\P a (9) J \sin0 cos 9 ) \Pa J ’ 

(Qb(Q)\ _ ( cos 9 sin (A (Qb\ 
\Pb(0)J ~ y— sin 9 cos Qj \P B J ’ 


(18a) 

(18b) 


Kind = PIa'B - Ieb , (22) 

where 0 < /3 < 1 is the reconciliation efficiency, Ia> b is the 
mutual information between Alice’s and Bob’s measurements, 
and I be is the mutual information between Eve’s and Bob’s 
measurements. These mutual informations are given by 

, - 4 ' B = 5 log2 (v7)' (23a) 

Ieb = ~ log 2 ( > (23b) 

2 \Vb\eJ 

where Vb = (Q^) is the variance of the quadrature Qb mea¬ 
sured by Bob, and 


and evaluating quantum expectation values over the unrotated 
state pab , as well as averaging over distributions of random 
variables 6 and (p. Using elements of the covariance matrix 
7 ab> it is straightforward obtain: 


/ 7T pK JQ 

dtpViv) J ^ [pabQ 2 a(0)\ = V, (19a) 

/ 7T Jf) 

—Tv [pabQ 2 b (9)\ = T V (V + X ), (19b) 


(QaQb) = [ dipV(ip) f 
J—TV J — 

= Ceos ip, 


dO m 
Tr 
27r 


PabQa(0)Qb{0) 

(19c) 


and analogously for other variances and correlations, thus re¬ 
producing the elements of 7 ab i R Eq. (14). 

Alice’s preparation of Gaussian-modulated coherent states 
in the prepare-and-measure description corresponds to her 
performing a heterodyne measurement on the state of mode A 
in the entanglement-based description. This heterodyne mea¬ 
surement is equivalent to mixing mode A with vacuum on a 
balanced beam splitter and performing homodyne measure¬ 
ments on conjugate quadratures of two output modes A' and 
A". Due to the symmetry between the two quadratures, it is 
sufficient to consider the measurement of the Q quadrature of 
mode A', which is given by 


Q A' 


1 

A 


{Q A H - Qvac) • 


( 20 ) 


T/ _ //o2 \ ( Qa'Qb ) 

Vb\a' = {Qb) - ~{Q^ )— 24 

is the conditional variance that quantifies Alice’s uncertainty 
on Qb after the measurement of Qa'- Using Eqs. (19) and 
(21), we obtain 

V B \A'=Tri\x+l + (V-m (25) 

and 

Y_ + x 1 n , 

x +i + (v-i)d’ 

where 


Ia'b = - log 2 


£ = 1 - (cosp) 2 . (27) 

We see from Eq. (25) that the effect of using the reference 
pulse is the increase in the conditional variance by the addi¬ 
tional term 


AVb\a' = V b \a’ ~ [Vb|a^ =0 = Tp{V - 1)£. (28) 

If the distribution V(<p) is tight, then cos(^ w 1 — and £ « 
c p 2 . Also, if condition (1) is satisfied, the 0 value is constant 
during each 0 estimation, and the variance of the estimated 
value is V§ =» XQ = (p 2 (recall that we assume symmetric 
V{(p), which implies Tp = 0). If V(<p) monotonically and 
rapidly decreases with \ip\ from the maximum value at cp = 0, 
the variance V$ = (p 2 is a tight upper bound on £, i.e., £ ;$ V$, 
and, consequently, 


Since the vacuum noise is not correlated with any other mode, 
it is easy to obtain: 


(Qa') ~ 2 ((Qa) + l) — 
(Qa'Qb) = ~^{QaQb) 


V v+i >• 

y/2 


(21a) 

(21b) 


KV b]a , < T V (V - 1)V § 
We can evaluate V§ by expressing it as 

2 


v . - r - 

9 J-* 27T 




J 8=8 


(29) 


(30) 
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where z = tan# = Pb r /qb r , dO/dz = cos 2 0 , and 


K = 


VQb* + 


<4 


^Pb r + fa 

4 


(31) 


is the dimensionless variance of the measured value of z. In 
Eq. (31), Sr = 1 in the single-reference-pulse mode (a hetero¬ 
dyne measurement is performed on a single reference pulse) 
and 5r = 0 in the twin-reference-pulse mode (sequential ho¬ 
modyne measurements are performed on a pair of twin refer¬ 
ence pulses). In general, the value of V z depends on the modu¬ 
lation used by Alice to generate reference pulses. In particular, 


1 / 2 

for fixed mean quadrature values q Ar — V R 
we find: 

and p AR = 0, 

Vqb r =V Pbr =T V (x + 1), 

(32a) 

<7b r = Tr lVR c °s 2 

(32b) 

Pb r = Tr/V R sin 2 6. 

(32c) 

By substituting these expressions into Eqs. (31) and (30), we 
obtain: 

v- - x + 1 + Sr 

8 Vr T V Vr 

(33) 


Correspondingly, the tight upper bound on the conditional 
variance increase due to the reference pulse use, given by 
Eq. (29), can be now expressed in terms of experimental pa¬ 
rameters: 


A V b .\a> £ 


(V-l)[Tr,( X + l) + 6 R } 


V, 


R 


(34) 


which scales as Va/Vr. The corresponding lower bound on 
the mutual information between Alice and Bob is 


I A' 


> 


2 l0g2 


V 


x 


<X+l)(l + V) 


+ 


(V-1)8 r 


(35) 


Now, to evaluate the mutual information between Eve and 
Bob, one can apply the Heisenberg uncertainty relation to the 
pure state held by Bob conditioned on Alice’s and Eve’s mea¬ 
surements, to obtain [2]: 


> 1? 


(36) 


where, due to the symmetry between Q and P quadratures, 
B stands for any quadrature of Bob’s mode. By substituting 
inequality (36) into Eq. (23b), we obtain: 

Ieb <-log 2 (VbVb\a) 

1 r 


< 


log2 f W(v + x) 


+(V 2 - 1) 


V 
x + l 


+ 


^x 

fa 


V r TrjV R 


]} 


where in the last line we have used £ ;S Vq to express the 
bound on mutual information in terms of experimental param¬ 
eters. 

Finally, putting together the bounds in Eqs. (35) and (37), 
we obtain the minimum key rate that is secure against individ¬ 
ual attacks, K- in & > expressed in terms of experimental 

parameters: 


is min P 1 

^ind — ^ lo S2 




(x + D faV) 


+ 


(V-l )Sr 

Tt]V r 


1, „ f (Trj) 2 (V + x) 
-2^{- V - 


Vx+ 1 


+{V 2 - 1) 


x +l , $r 


(38) 


Vr TrjV R , 

Note that all terms associated with the reference pulse’s quan¬ 
tum uncertainty reduce the key rate and scale inversely with 
Vr. In the limit of a large-amplitude (classical) reference 
pulse, Vr oo, the theoretical key rate of SR-CV-QKD is 
the same as that for the respective conventional CV-QKD pro¬ 
tocol that requires LO transmission [2, 24]. However, even in 
this limit, SR-CV-QKD could still be practically advantageous 
since it avoids many technical difficulties associated with LO 
transmission, as detailed in Sec. I. 


B. Collective attacks 

The expected secret key rate against collective attacks for 
reverse reconciliation is given by 

K co i = /3Ia'b - Xbe , (39) 

where the lower bound on I A 'b is given by Eq. (35) and xbe 
is the Holevo quantity for Eve’s maximum accessible informa¬ 
tion. For Gaussian protocols, the Holevo quantity is [21, 24] 

XBE = S{p AB ) - S{~Pa), (40) 

where S(p) is the von Neumann entropy of the state p, p AB 
is the state shared between Alice and Bob before they per¬ 
form any measurements, and p q J* is the state of Alice’s sys¬ 
tem conditional on Bob’s measurement outcome q B . Since 
these states are Gaussian, the entropy is evaluated in terms of 
symplectic eigenvalues of the covariance matrices of the cor¬ 
responding states [6] . This procedure results in [24] 

xbe = ° (X 1 ) + ° (V) (V) • <4i » 

where G{x) = (x +1) log 2 (x +1)—x log 2 (x), and the eigen¬ 
values A ? are obtained from 


A?, 2 = 1(A±v/A2-4£>2), 


(42a) 


A = V 2 (l — 2Trj) + (Tr]) 2 (V + x) 2 

+2 Tri [1 + (V 2 - 1)£] , (42b) 

D = T V [V X + 1 + (V 2 - 1)£] , (42c) 

Vx + 1 + (V 2 - 1)£ 


A 2 = F 


v + x 


(37) 


(42d) 
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FIG. 3. Expected minimum key rates for the SR-CV-QKD proto¬ 
col, secure against (a) individual attacks and (b) collective attacks, as 
functions of the effective transmittance T e ff = Tr\. The parameter 
values used are Va = 40, £ = 0.01, V e \ = 0.01 (all in shot-noise 

units), [3 = 0.95, Sr = 1 . As shown in the legend, different curves 

1 /2 

correspond to different values of the reference-pulse amplitude V R 
(specifically, Vr/Va = {10, 20, 50,100, 200, 500}), along with the 
curve for £ =s 0, in which case the key rate is the same as that for 
the respective conventional CV-QKD protocol with LO transmission. 
The curves terminate on the left at values of T e ff below which the ex¬ 
pected secret key rate is zero. 


Furthermore, we find that xbe monotonically increases as 
£ increases, and therefore we can upper bound xbe using 
£ < Vq. Thus, replacing £ in Eqs. (42) with expression (33) 
for Vq completes the derivation of the minimum expected key 
rate that is secure against collective attacks, K co \ > K™ j n , 
in terms of experimental parameters. We note that since SR- 
CV-QKD is a Gaussian protocol, security against collective 
attacks is sufficient for asymptotic unconditional security (i.e., 
security against coherent attacks) with some processing over¬ 
head [28, 29]. 

Figure 3 shows the expected minimum key rates secure 
against individual and collective attacks, as expressed by 
and K ™} n , respectively. Each plot shows the key rate 
as a function of the effective transmittance T e ff = Trj, for 
a number of reference-pulse amplitude values ( Vr/Va = 
{10, 20, 50,100, 200, 500} with V A = 40) and also for £ = 0 


(which results in the same key rate as the respective con¬ 
ventional CV-QKD protocol with LO transmission). We see 
that as Vr increases the performance of SR-CV-QKD ap¬ 
proaches that of conventional CV-QKD, and at Vr ~ 500Va 
the achievable key rates are very similar for the two proto¬ 
cols. Figure 3 shows results for the single-reference-pulse 
mode (Sr = 1); the results for the twin-reference-pulse mode 
(Sr = 0) are very similar, except that smaller values of 
Vr/Va are required to approach the £ = 0 curve, which is 
a result of the higher accuracy of the phase difference estima¬ 
tion possible in this mode of operation. 


IV. EXPERIMENTAL CHARACTERIZATION AND 
DEMONSTRATION 

The primary benefit of the SR-CV-QKD protocol is the re¬ 
duction in hardware it enables at the transmitter and receiver. 
A schematic of our proof-of-principle experimental imple¬ 
mentation of the SR-CV-QKD protocol is shown in Fig. 4. 
Since our purpose is to demonstrate the feasibility of the SR- 
CV-QKD protocol, the channel fiber length between Alice and 
Bob in all of the experiments reported on below was only 5 m. 
Also, as shown in Fig. 4, we used a single laser for both Al¬ 
ice’s and Bob’s stations, which sat on the same optical table. 
We note that this was purely a matter of experimental conve¬ 
nience in a situation with limited resources, while any practi¬ 
cal implementation of the protocol will definitely require sep¬ 
arate laser sources for Alice and Bob. In addition, the use of a 
common laser source obviates the need to frequency lock Al¬ 
ice’s and Bob’s lasers, an additional experimental challenge 
that would have to be tackled in a practical setup as discussed 
in Sec. II. Nevertheless, crucial to this demonstration, due 
to the difference between the paths from the laser source to 
Alice’s modulation component and from the laser source to 
Bob’s detection apparatus, the phase difference between Al¬ 
ice’s and Bob’s frames was random and fluctuating (as shown 
below in Fig. 5). 

Extending the SR-CV-QKD operation to practical distances 
and including the use of separate laser sources in Alices and 
Bobs stations, are part of ongoing work in our laboratory. Fur¬ 
ther details of the current experimental setup are given in Ap¬ 
pendix A. 


A. Signal retrieval under strong phase noise 

We first demonstrate the ability of the protocol to detect the 
phase drift and compensate for it. For this purpose we let Bob 
compensate his measured quadrature values rather than send 
the phase estimate to Alice. Each signal pulse is prepared 
in a constant coherent state and is accompanied by a refer¬ 
ence pulse that is also prepared in a constant coherent state 
with with mean quadrature values (qa r •> Pa r ) = (30,0). Bob 
measures both Q and P quadratures of signal and reference 
pulses using his own LO, and the measured data are shown 
in Figs. 5(a) and 5(b). The fluctuations of measured mean 
quadrature values of both signal and reference pulses indi- 
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FIG. 4. Schematic of experimental setup for proof-of-principle 
demonstration of SR-CV-QKD. The only difference between this 
schematic and Fig. 1 is the use of a shared laser source between 
Alice and Bob for experimental convenience. 




(a) Reference pulses (b) Signal pulses 



FIG. 5. Phase drift estimation and compensation for constant sig¬ 
nal pulses. Bob’s measured voltages proportional to mean values of 
Q quadrature (blue dots) and P quadrature (red dots) for (a) refer¬ 
ence pulses and (b) signal pulses, (c) Estimated values 0 of the phase 
difference between Alice’s and Bob’s frames. Each data point is cal¬ 
culated as in Eq. (4) using mean quadrature values qs R and ps R 
obtained from sequential homodyne measurements on a pair of twin 
reference pulses, (d) Mean values of Q quadrature (blue dots) and P 
quadrature (red dots) for signal pulses, after a rotation by the angle 
—0 to compensate for the phase drift. 


cate the phase drift happening in the setup. Bob’s estimate of 
the drifting phase, calculated using measurements of reference 
pulses’ quadratures, is shown in Fig. 5(c), and mean quadra¬ 
ture values of signal pulses, compensated in accordance with 
the estimated phase, are shown in Fig. 5(d). The compensa¬ 
tion successfully recovers the constant signal that Alice sent 
despite the variation of the phase difference between Alice’s 
and Bob’s frames. The phase-space representation of Bob’s 
compensated signal is shown in Fig. 6. The variances of the 



FIG. 6. The phase-space representation of reconstructed signal 
pulses after phase drift compensation. 


reconstructed signal data is 1.16. 

We note that in this setup Bob was restricted to performing 
homodyne measurements and therefore could measure only 
one quadrature per pulse. Therefore Alice sent two identi¬ 
cal signal pulses and two identical reference pulses in succes¬ 
sion (the twin-pulse mode). The time taken for Bob to per¬ 
form homodyne measurements on all four pulses (16 fi s) is 
much shorter than the characteristic time of phase fluctuations 
(fp ~ 200 M s). 


B. Signal constellation reconstruction and noise estimation 

Next, we report reconstruction of a constellation of sig¬ 
nal pulses, which demonstrates the effectiveness of the self- 
referenced technique for signals over a large area in the phase 
space. In this experiment, we used a square grid in Alice’s 
phase plane, with tiles of size 5x5 and centers of tiles span¬ 
ning from -15 to 15 in both quadrature axes (for a total of 49 
tiles). Alice generated 1000 identical signal pulses prepared 
in a coherent state centered on each tile, and sent them to Bob. 
Each pair of signal pulses was accompanied by a pair of ref¬ 
erence pulses; all reference pulses were identical with mean 
quadrature values ( qA R ,PA R ) = (30,0). Bob performed ho¬ 
modyne measurements of Q and P quadratures on each pair 
of twin signal pulses (resulting in 500 paired data points for 
each grid tile), as well as on each pair of twin reference pulses. 
In the same manner as described in Sec. IV A above, Bob used 
quadrature measurements on reference pulses to estimate the 
fluctuating phase difference between his and Alice’s frames, 
and then compensated for estimated phase values to recover 
signal pulses sent by Alice. Figure 7 shows the reconstructed 
constellation of signal pulses. The distribution of Bob’s re¬ 
constructed signals is quite uniform in both quadratures for 
each of the grid tiles. However, one can notice the known 
“zero anomaly” [30, 31], which is manifested as a skewed 
distribution of reconstructed values near the vacuum, arising 
due to a finite extinction ratio of Alice’s electro-optic modu- 
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FIG. 7. The phase-space representation of signal pulses recon¬ 
structed using quadrature measurements on reference pulses and 
phase difference estimation. 



FIG. 8. The variance of the reconstructed signal data as a function of 
the phase-space location. 


lator (EOM) used for amplitude modulation. This undesirable 
effect can be mitigated by using an EOM with a higher ex¬ 
tinction ratio or chaining multiple EOMs to achieve greater 
extinction. 

Typical Gaussian-modulated coherent-state pulses used as 
signals in CV-QKD have the modulation variance Va ~ 40, 
and the purpose of the presented example is to demonstrate 
that such signals can be accurately reconstructed using refer¬ 
ence pulses and phase difference estimation. We emphasize 
that during this entire experiment (which involved transmis¬ 
sion of 49,000 signal pulses and reconstruction of 24,500 pairs 
of mean quadrature values) we did not have to concern our¬ 
selves with the stability of Bob’s LO since the random phase 
drift was compensated at all times using the self-referenced 
technique. 

Next, we extended the characterization of signal pulses to 
the evaluation of the excess noise in the combined system, in¬ 
cluding Alice’s encoding and Bob’s decoding apparatus. In 
this experiment, we used the same reconstruction procedure 
for a constellation of coherent-state signal pulses as described 
above, but applied it to a different sample. With a finer grid 
tiling (2.5 x 2.5), the number of tiles was four times greater 
(for a total of 196 tiles), but only 250 identical signal pulses 
were generated for each tile. After performing the reconstruc¬ 
tion of the signal’s mean quadrature values, we calculated the 
variance of the reconstructed data for each grid tile. Figure 8 
shows this variance as a function of the location on the phase- 
plane grid. Any variance in excess of 1 is the excess noise 
introduced by the experimental apparatus, channel, or phase 
estimation procedure. We note that the variance distribution is 
quite uniform (0.95-1.2) over much of the considered phase- 
plane region. The average variance value over the entire con¬ 
stellation is 1.16. Thus the entire apparatus, including the 
phase compensation step, has a total excess noise of 0.16. This 
excess noise is due to several experimental imperfections, in¬ 


cluding non-uniform performance and calibration of EOMs 
across the phase plane and electronic noise in detectors. 


C. Demonstration of SR-CV-QKD with Gaussian modulation 

In addition to the above experiments that utilized the self- 
referenced technique for reconstruction of signal pulses in the 
presence of phase fluctuations and for characterization of the 
excess noise, we also performed the quantum components of 
an experimental secret key distribution using the SR-CV-QKD 
protocol. The QKD experiment was performed under a strong 
phase noise between Alice’s signal-generating laser and Bob’s 
LO. 

We used a pseudo-random number generator based on the 
Mersenne twister for Alice’s signal modulation and Bob’s 
measurement axis selection. Each communication block con¬ 
sisted of 24,500 data points. Alice’s pulse generation rate was 
250 kHz; two thirds of these were identical reference pulses 
(used in the twin-reference-pulse mode), and one-third were 
signal pulses prepared in random Gaussian-modulated coher¬ 
ent states. Alice’s Gaussian modulation variance was Va = 
34, and mean quadrature values of reference pulses were 
(■ <1a r ,Pa r ) = (30,0), corresponding to V R /V A « 26.47 
3 . Since the transmission was only across an optical table, 


3 This (relatively low) value of the Vr/Va ratio is related to the fact that, in 
our proof-of-principle experiment, we placed more importance on the mea¬ 
surement precision rather than on the distance or rate of the key distribu¬ 
tion. Specifically, due to the limited dynamic range of our analog-to-digital 
converter (ADC), the maximum value of Vr had to be restricted in order to 
achieve a high precision of the signal homodyne measurement. This is not 
a fundamental restriction since ADCs with better resolution are available 
and moreover, in practical long-distance QKD, the required homodyne pre- 
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T = 1. Accounting for detector efficiency, homodyne visi¬ 
bility, and imperfections in homodyne arm balancing, Bob’s 
homodyne efficiency was estimated to be 7 = 0.719 on aver¬ 
age, however due to fluctuating mode-matching and homo¬ 
dyne arm balancing conditions this efficiency can fluctuate 
± 0 . 1 . 

At each round (consisting of two reference pulses and one 
signal pulse), Bob estimated the phase difference between his 
and Alise’s frames and communicated this estimate to Alice, 
who performed the compensation rotation on the tabulated 
random values of the signal pulse quadratures. 

In each session, among the 24,500 pulses exchanged, 2000 
were randomly selected for estimation of the covariance ma¬ 
trix between Alice’s and Bob’s measurements during the pa¬ 
rameter estimation stage. An example of such an estimated 
covariance matrix is: 



—pm, exp 
i AB 


( 33.9637 -0.9647 
-0.9647 34.3744 
31.1408 -1.0830 
\ -0.0763 30.7054 


31.1408 -0.0763 \ 
-1.0830 30.7054 | 
29.4003 -0.2307 ' 

-0.2307 28.2540 / 

(43) 


Note that this covariance matrix corresponds to the prepare- 
and-measure version of the protocol and thus differs from 


' y AB of Eq. (14). The theoretical form of 7 ^ is 


—pm,the ( V A II a/Tt/Va COS (fill \ 

7ab {^jV A coslpl Tr,{V A + 1 + X) V ’ 


where we used the assumption of symmetric V(ip) to set 
sirup = 0. We can achieve reasonably good agreement 
between this theoretical form and the experimentally recon¬ 
structed covariance matrix using the above values for Va, 
Vr, and T, along with the calibrated values e = 0.01 and 
V e \ = 0.01, and a value of homodyne efficiency at the up¬ 
per limits of our calibrated range, 7 = 0 . 8 , which yields the 
theoretical covariance matrix 


—pm,the 
7 AB 


/ 34.000 0.000 
0.000 34.000 
30.389 0.000 
V 0.000 30.389 


30.389 0.000 \ 
0.000 30.389 | 
28.218 0.000 
0.000 28.218 / 


(45) 


Using the above parameter values, we also calculate mu¬ 
tual information bounds: Ia'b ~ 2.37 bit/round, Ieb < 
1.492 bit/round, and Xbe ~ 1.742 bit/round (a round con¬ 
sists of three pulses, two reference and one signal). As¬ 
suming the reconciliation efficiency value of /3 = 0.95, 
the expected minimum key rates secure against individual 
and collective attacks are « 0.759 bit/round and 

KZ n ~ 0.509 bit/round, respectively. Taking into account 
that SR-CV-QKD in the twin-reference-pulse mode utilizes 
three pulses per round, the key rates per physical pulse would 
be three times lower. Finally, with the pulse generation rate 


cision is less stringent (typically less than 5 binary digits), especially when 
the signal-to-noise ratio is less than 1. 


FIG. 9. Expected key rates as a function of transmission distance for 
current experimental setup and a range of post-processing efficiency 
values (/?). The parameters used are: Va = 34, Vr = 900, Sr = 
0, e = 0.01, V e \ = 0.01 and pulse rate of 250 kHz. The homodyne 
efficiency was taken to be the average value (this quantity fluctuates 
in our setup — see main text) of 77 = 0.719. The transmission loss 
was taken to be 0.2 dB/km. 


of 250 kHz, the expected minimum key rates are « 

63.26 kbit/s and K™ j n « 42.45 kbit/s. 

It should be noted that the primary factor that dictates the 
key rate in our setup is the pulse generation rate. We had 
to maintain this at the low rate of 250 kHz because the data 
acquisition hardware we used (National Instruments, PCIE- 
6363) supports only 250 kHz signal generation and measure¬ 
ment rates (taking into account rise and fall times of pulses). 

This demonstration is a proof-of-principle of the SR-CV- 
QKD protocol and the feasibility of phase difference estima¬ 
tion and compensation using reference pulses. Therefore we 
choose a negligible transmission distance. In Figure 9 we plot 
the achievable key rates as a function of transmission distance 
using this experimental setup for a range of post-processing 
efficiencies. The next generation of this experiment will in¬ 
clude an upgrade of this hardware to increase pulse genera¬ 
tion rates and focus on increasing key rate and extending key 
distribution distance using SR-CV-QKD. 


V. CONCLUSIONS AND DISCUSSION 

We have developed a new protocol, SR-CV-QKD, that 
eliminates the need to transmit an LO. The removal of this 
demand dramatically simplifies the hardware required to per¬ 
form CV-QKD and removes the most significant obstacles to 
developing integrated photonics implementations of CV-QKD 
transceivers. We thus believe that this new protocol will play 
a key role in enabling the miniaturization of CV-QKD hard¬ 
ware, which has the potential to significantly enhance the ap¬ 
plicability of quantum communications. 

In the reported experiments, we characterized the core new 
element of SR-CV-QKD, signal reconstruction through com- 
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pensation of the drifting phase, and performed a proof-of- 
principle demonstration of key distribution using the new pro¬ 
tocol. On the theory side, we computed expected key rates, 
secure under a passive Gaussian channel assumption. A prin¬ 
cipal feature of our security analysis is the incorporation of the 
inherent quantum uncertainty of reference pulses. We showed 
that as the reference pulse amplitude increases, the key rate of 
SR-CV-QKD approaches that of conventional CV-QKD with 
LO transmission, but that this rate can be achieved with much 
simpler hardware. Our analysis has focused on asymptotic 
key rates as a first step in understanding the new prototol, but 
we expect that recent results in that calculate secure key rates 
with finite-size effects included [13-15] can be adapted to SR- 
CV-QKD. 

A way to view the difference between SR-CV-QKD and 
conventional CV-QKD is that while the latter physically trans¬ 
mits a reference frame (in the form of the LO), the former only 
transmits information about the reference frame. As a result, 
SR-CV-QKD is immune against many of the recently identi¬ 
fied side-channel attacks that exploit detection using a pub¬ 
licly shared high-power LO [32, 33]. Of course, it remains to 
be seen whether new side channel attacks that target SR-CV- 
QKD are possible. 

In this work, we focused on a version of SR-CV-QKD, in 
which Alice prepares signal and reference pulses in coherent 
states, and Bob performs a homodyne measurement on the 
signal pulse. More generally, it is possible (in analogy with a 
variety of conventional CV-QKD protocols [24]) to consider 
alternative versions of SR-CV-QKD. For example, Alice can 
prepare the signal pulse in a squeezed state, Alice can pre¬ 
pare a pair of reference pulses in orthogonal squeezed states, 
Bob can perform a heterodyne measurement on the signal 
pulse, Bob can perform a homodyne measurement of a ran¬ 
dom quadrature, and so on. 

It should be noted that in classical optical communication 
based on coherent detection, reference laser pulses have been 
used as a direct phase reference for signal generation and 
phase noise cancellation and stabilization. In particular, in for¬ 
mats involving quadrature phase-shift keying and quadrature 
amplitude modulation, the self-homodyne detection (SHD) 
approach [34-36] makes use of dedicated pilot carrier pulses 
that are multiplexed with the signal pulses from the same 
laser to enable homodyne detection at the receiver. SR-CV- 
QKD is in the same spirit as these techniques, except that, un¬ 
like SHD, our protocol enables absolute amplitude and phase 
measurement in the low-photon-number regime with encod¬ 
ing and decoding capabilities across a continuous amplitude 
and phase variation in real-time. The method of phase estima¬ 
tion and compensation underlying the SR-CV-QKD protocol 
can be considered a close quantum analog of intradyne detec¬ 
tion [37], another approach used in classical coherent com¬ 
munication, which digitally estimates phase (and frequency) 
drifts using measurements on part of the modulated signal 
pulse. An important aspect of adapting this technique to CV- 
QKD is that the measurement for phase estimation should be 
performed on a dedicated reference pulse rather than directly 
on the signal pulse, because at the intensity levels used for 
CV-QKD, detection of any portion of the signal pulse would 


severely decrease achievable key rates. As a matter of fact, the 
precision of phase estimation achieved via the direct measure¬ 
ment on the signal pulse would correspond to SR-CV-QKD 
with Vr/Va < 1. According to Fig. 3, such a low Vr/Va 
value would not be practical (this is because QKD operates 
near shot-noise levels). Therefore, dedicated reference pulses 
with sufficiently large amplitude are required as prescribed by 
SR-CV-QKD. 

Previous CV-QKD experiments have made use of strong 
calibration pulses to compensate for phase drifts created by 
the signal and LO having different propagation paths at the re¬ 
ceiver [38-40]. However, it should be noted that these experi¬ 
ments co-transmitted the signal and LO and hence do not use 
the phase compensation to its full extent. Also, in the context 
of the B92 DV-QKD protocol [41], Koashi has constructed a 
modified scheme whereby Bob estimates the phase difference 
between his and Alice’s lasers [42]. However, unlike in SR- 
CV-QKD where this estimate is used to modify Alice’s clas¬ 
sical data, Koashi’s scheme uses the estimate to phase shift 
a weak field that interferes with Alice’s signal. The SR-CV- 
QKD protocol is practically much simpler since no dynamic 
tuning of optical components conditioned on the phase esti¬ 
mate (optical feed forward control) has to be performed. 

We note that this new CV-QKD protocol was independently 
discovered by Qi et al ., as recently reported in Ref. [26]. Qi et 
al. present a complementary study of the protocol, including 
its implementation to perform key distribution over a 25 km 
link, which goes beyond our proof-of-principle demonstra¬ 
tion. In contrast, in this work, we focused on a comprehensive 
analysis of the fundamental limits of the protocol (expected 
secret key rate calculations taking into account the quantum 
uncertainty of reference pulses and accuracy of the phase es¬ 
timation, in Sec. Ill), and characterization of the performance 
of the central new element in the protocol: phase drift com¬ 
pensation using reference pulses (in Sec. IV). Note that the 
expected key rates calculated by Qi et aims larger than those 
calculated in this work because while we use the strictest se¬ 
curity criterion [2], Qi et al. use the relaxed criterion where 
calibrated noise and loss at Bob’s receiver are assumed to be 
out of Eve’s control. Our results, along with the demonstration 
in Qi et al. [26], establish SR-CV-QKD as a practical protocol 
with significant benefits in terms of hardware simplification 
and potential compatibility with integrated photonics. 

Finally, while this manuscript was under review Huang et 
al. reported on an implementation of CV-QKD over a 25-km 
link without transmission of a local oscillator, which utilizes 
a protocol that is essentially the same as SR-CV-QKD [43]. 

Ongoing work in our laboratory is focused on increasing 
the key rate and transmission distance of the SR-CV-QKD link 
and increasing the stability and robustness of the transmitter 
and receiver components. 
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Appendix A: Experimental details 




Voltage [V] 

(b) Calibration curve after phase 
drift compensation 


In this appendix, we provide the details of our experimental 
setup. 

The laser source was a fiber-pigtailed New Focus single¬ 
frequency laser at 1550 nm, with an optical bandwidth of 
^100 kHz, and a maximum output power of 7 mW. After an 
in-line polarizer, the polarization extinction ratio was 35 dB 
(all fiber used in the experiment was polarization maintaining 
Panda PM1300 fiber). An acousto-optic modulator (Brim- 
rose) modulated the output of the laser at 250 kHz with in¬ 
dividual pulse duration of 200 ns. The amplitude and phase 
of the light were modulated through 10 GHz fiber-pigtailed 
amplitude and phase EOMs (Thorlabs). 

At Bob’s station, received light pulses were detected using a 
homodyne setup, as shown in Fig. 1 . Although in practice Bob 
will use an independent laser as an LO for homodyne mea¬ 
surements, in our experiment, for simplicity, Alice and Bob 
shared the same single-frequency laser source. However, it is 
critical to note that, due to the difference between the paths 
from the laser source to Alice’s modulation component and 
from the laser source to Bob’s detection apparatus, the phase 
difference between Alice’s and Bob’s frames was random and 
fluctuating (as shown in Fig. 5). Bob’s LO power was 0.1 mW. 
For homodyne detection, we used a polarization-maintaining 
fiber beam splitter with an approximately 51:49 splitting ratio 
(Thorlabs). We attached a mechanical variable optical attenu¬ 
ator to each leg after the beam splitter to balance the power 
between the two legs. For the balanced detector, we used 
a commercially available switchable-gain fast InGaAs detec¬ 
tor (Thorlabs PDB450C). The detection bandwidth was set at 
45 MHz where we observed that the dark current noise was 
approximately 25 dB lower than the shot noise from Bob’s 
LO. Accounting for detector efficiency, homodyne visibility, 
and imperfections in homodyne arm balancing, Bob’s homo¬ 
dyne efficiency was estimated to be ij = 0.719 on average, 
however due to fluctuating mode-matching and homodyne 
arm balancing conditions this efficiency can fluctuate ±0.1. 
We are currently making progress in understanding the root 
causes of this uncertainty and how to stabilize it. 

For data collection and analog voltage generation for the 
EOMs, we used a commercially available data acquisition 
card (NI PCIE-6363), capable of reliably collecting multi¬ 
channel data at 250 kHz. Since the analog output of this card 
has 1 MU impedance while the EOM’s RF modulation in¬ 
put has 50 D impedance, we built in a fast unity-gain voltage 
follower to match the impedances. All data generation and 
collection were performed through Matlab’s data acquisition 
toolbox based codes. 


FIG. 10. In-situ calibration of a phase EOM using reference pulses 
and phase drift compensation, (a) Raw data collected while the 
modulation voltage is swept from — 3.5Vto3.5V within the time 
window (5-58 ms); red: in-phase value of the reference pulse, ma¬ 
genta: quadrature value of the reference pulse, blue: in-phase value 
of the phase-modulated pulse, cyan: quadrature value of the phase- 
modulated pulse, (b) The calibration curve between the applied volt¬ 
age and the induced phase after phase drift compensation; blue dots: 
calibration data, red line: polynomial fit. 


Appendix B: Device calibration with reference pulses 

The technique of using reference pulses and phase estima¬ 
tion to compensate for phase drifts is valuable not only for 
running the CV-QKD protocol per se , but also for the calibra¬ 
tion of Alice’s and Bob’s apparatus. Since CV-QKD operates 
at the limits of detection, it is vital to calibrate, and maintain 
calibration of, the modulators and homodyne detectors in the 
setup. Typically, this calibration is done locally by Alice and 
Bob to minimize security loopholes, and for this reason Al¬ 
ice’s station should have homodyne or heterodyne detection 
capabilities and Bob’s station should have pulse generation 
capabilities. In this appendix, we present a calibration task 
that Alice and Bob need to perform and show that it benefits 
greatly from the use of reference pulses and phase estimation. 

It is critical that the phase induced by Alice’s and Bob’s 
phase EOM is well calibrated against the applied voltage; i.e., 
the actual phase modulation should correspond accurately to 
the random numbers generated by Alice, or the measurement 
axis chosen by Bob. In a long-running CV-QKD implemen¬ 
tation, this calibration may have to be performed repeatedly 
since EOM characteristics can drift over time. The calibration 
requires performing a test phase modulation and measuring 
its value. The measurement is performed using a homodyne 
setup that utilizes an LO generated from the same master laser 
as the modulated pulse. As a result, this calibration requires 
precise knowledge of the path difference (which results in a 
relative phase shift) between the modulation path and the LO 
path. This path difference can fluctuate due to thermal effects 
and tracking it requires a considerable effort. 

Noting that the calibration problem in the presence of a 
phase drift is very similar to the problem of establishing a 
common phase reference in CV-QKD, it is clear that we can 
alternatively use reference pulses to perform the EOM phase 
calibration. That is, during the calibration stage, each phase- 
modulated pulse is accompanied by a reference pulse (with 
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no phase modulation). The procedure of heterodyne measure¬ 
ment and phase estimation on this reference pulse tells us what 
the reference zero phase modulation value is, and this can be 
used to recover the actual phase of the modulated pulse. 

Figure 10(a) shows raw measured values for the phase- 
modulated pulse when the EOM voltage is swept from —3.5V 
to 3.5 V, along with those for the accompanying reference 


pulse. Within this voltage range the EOM response is reason¬ 
ably linear. The raw voltages show that the phase does drift 
over the timescale of the sweep. However, Fig. 10(b) shows 
that by estimating the drifting phase and compensating for it, 
one can obtain a clean calibration map between the applied 
voltage and the induced phase. 
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